@intentius/chant-lexicon-k8s 0.46.0 → 0.49.0

package/dist/index.d.ts

@@ -6,10 +6,11 @@ export { kustomizeApplyCapability, createKustomizeApplyCapability, type Kustomiz
 export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels.js";
 export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels.js";
 export { K8sLabels, K8sAnnotations } from "./variables.js";
+export { GENERATED_ONCE_LABEL_KEY, GENERATED_ONCE_LABEL_VALUE, isGeneratedOnce } from "./secret-labels.js";
 export { microTime, isMicroTimeFormatted } from "./micro-time.js";
 export * from "./generated/index.js";
-export { WebApp, StatefulApp, CronWorkload, AutoscaledService, WorkerPool, NamespaceEnv, NodeAgent, BatchJob, SecureIngress, ConfiguredApp, SidecarApp, MonitoredService, NetworkIsolatedApp, IrsaServiceAccount, AlbIngress, EbsStorageClass, EfsStorageClass, FluentBitAgent, ExternalDnsAgent, AdotCollector, MetricsServer, WorkloadIdentityServiceAccount, GcePdStorageClass, FilestoreStorageClass, GkeGateway, ConfigConnectorContext, GceIngress, CockroachDbCluster, CockroachDbRegionStack, RayCluster, RayJob, RayService, ArgoAppFor, ArgoAppSetForRegions, registerArgoCluster, FluxGitSource, FluxAppFor, AgicIngress, AzureDiskStorageClass, AzureFileStorageClass, AzureMonitorCollector, AksWorkloadIdentityServiceAccount, GkeFluentBitAgent, GkeOtelCollector, GkeExternalDnsAgent, AksExternalDnsAgent, } from "./composites/index.js";
-export type { WebAppProps, WebAppResult, StatefulAppProps, StatefulAppResult, CronWorkloadProps, CronWorkloadResult, AutoscaledServiceProps, AutoscaledServiceResult, WorkerPoolProps, WorkerPoolResult, NamespaceEnvProps, NamespaceEnvResult, NodeAgentProps, NodeAgentResult, BatchJobProps, BatchJobResult, SecureIngressProps, SecureIngressResult, ConfiguredAppProps, ConfiguredAppResult, SidecarAppProps, SidecarAppResult, MonitoredServiceProps, MonitoredServiceResult, NetworkIsolatedAppProps, NetworkIsolatedAppResult, IrsaServiceAccountProps, IrsaServiceAccountResult, AlbIngressProps, AlbIngressResult, EbsStorageClassProps, EbsStorageClassResult, EfsStorageClassProps, EfsStorageClassResult, FluentBitAgentProps, FluentBitAgentResult, ExternalDnsAgentProps, ExternalDnsAgentResult, AdotCollectorProps, AdotCollectorResult, MetricsServerProps, MetricsServerResult, WorkloadIdentityServiceAccountProps, WorkloadIdentityServiceAccountResult, GcePdStorageClassProps, GcePdStorageClassResult, FilestoreStorageClassProps, FilestoreStorageClassResult, GkeGatewayProps, GkeGatewayResult, ConfigConnectorContextProps, ConfigConnectorContextResult, GceIngressProps, GceIngressResult, CockroachDbClusterProps, CockroachDbClusterResult, CockroachDbRegionStackConfig, CockroachDbRegionCockroachConfig, CockroachDbRegionTlsConfig, RayClusterProps, RayClusterResult, RayClusterSpec, ResourceSpec, HeadGroupSpec, WorkerGroupSpec, RayJobProps, RayJobResult, RayServiceProps, RayServiceResult, ArgoDestination, ArgoSyncPolicy, ArgoAppForOptions, ArgoAppForResult, ArgoRegionTarget, ArgoAppSetForRegionsOptions, ArgoAppSetForRegionsResult, RegisterArgoClusterOptions, RegisterArgoClusterResult, FluxSourceKind, FluxSourceRef, FluxGitSourceOptions, FluxGitSourceResult, FluxAppForOptions, FluxAppForResult, AgicIngressProps, AgicIngressResult, AzureDiskStorageClassProps, AzureDiskStorageClassResult, AzureFileStorageClassProps, AzureFileStorageClassResult, AzureMonitorCollectorProps, AzureMonitorCollectorResult, AksWorkloadIdentityServiceAccountProps, AksWorkloadIdentityServiceAccountResult, GkeFluentBitAgentProps, GkeFluentBitAgentResult, GkeOtelCollectorProps, GkeOtelCollectorResult, GkeExternalDnsAgentProps, GkeExternalDnsAgentResult, AksExternalDnsAgentProps, AksExternalDnsAgentResult, } from "./composites/index.js";
+export { WebApp, StatefulApp, CronWorkload, AutoscaledService, WorkerPool, NamespaceEnv, NodeAgent, BatchJob, SecureIngress, ConfiguredApp, SidecarApp, MonitoredService, NetworkIsolatedApp, IrsaServiceAccount, AlbIngress, EbsStorageClass, EfsStorageClass, FluentBitAgent, ExternalDnsAgent, AdotCollector, MetricsServer, WorkloadIdentityServiceAccount, GcePdStorageClass, FilestoreStorageClass, GkeGateway, ConfigConnectorContext, GceIngress, CockroachDbCluster, CockroachDbRegionStack, RayCluster, RayJob, RayService, ArgoAppFor, ArgoAppSetForRegions, registerArgoCluster, FluxGitSource, FluxAppFor, AgicIngress, AzureDiskStorageClass, AzureFileStorageClass, AzureMonitorCollector, AksWorkloadIdentityServiceAccount, GkeFluentBitAgent, GkeOtelCollector, GkeExternalDnsAgent, AksExternalDnsAgent, Model, resolveModelStorageUri, } from "./composites/index.js";
+export type { WebAppProps, WebAppResult, StatefulAppProps, StatefulAppResult, CronWorkloadProps, CronWorkloadResult, AutoscaledServiceProps, AutoscaledServiceResult, WorkerPoolProps, WorkerPoolResult, NamespaceEnvProps, NamespaceEnvResult, NodeAgentProps, NodeAgentResult, BatchJobProps, BatchJobResult, SecureIngressProps, SecureIngressResult, ConfiguredAppProps, ConfiguredAppResult, SidecarAppProps, SidecarAppResult, MonitoredServiceProps, MonitoredServiceResult, NetworkIsolatedAppProps, NetworkIsolatedAppResult, IrsaServiceAccountProps, IrsaServiceAccountResult, AlbIngressProps, AlbIngressResult, EbsStorageClassProps, EbsStorageClassResult, EfsStorageClassProps, EfsStorageClassResult, FluentBitAgentProps, FluentBitAgentResult, ExternalDnsAgentProps, ExternalDnsAgentResult, AdotCollectorProps, AdotCollectorResult, MetricsServerProps, MetricsServerResult, WorkloadIdentityServiceAccountProps, WorkloadIdentityServiceAccountResult, GcePdStorageClassProps, GcePdStorageClassResult, FilestoreStorageClassProps, FilestoreStorageClassResult, GkeGatewayProps, GkeGatewayResult, ConfigConnectorContextProps, ConfigConnectorContextResult, GceIngressProps, GceIngressResult, CockroachDbClusterProps, CockroachDbClusterResult, CockroachDbRegionStackConfig, CockroachDbRegionCockroachConfig, CockroachDbRegionTlsConfig, RayClusterProps, RayClusterResult, RayClusterSpec, ResourceSpec, HeadGroupSpec, WorkerGroupSpec, RayJobProps, RayJobResult, RayServiceProps, RayServiceResult, ArgoDestination, ArgoSyncPolicy, ArgoAppForOptions, ArgoAppForResult, ArgoRegionTarget, ArgoAppSetForRegionsOptions, ArgoAppSetForRegionsResult, RegisterArgoClusterOptions, RegisterArgoClusterResult, FluxSourceKind, FluxSourceRef, FluxGitSourceOptions, FluxGitSourceResult, FluxAppForOptions, FluxAppForResult, AgicIngressProps, AgicIngressResult, AzureDiskStorageClassProps, AzureDiskStorageClassResult, AzureFileStorageClassProps, AzureFileStorageClassResult, AzureMonitorCollectorProps, AzureMonitorCollectorResult, AksWorkloadIdentityServiceAccountProps, AksWorkloadIdentityServiceAccountResult, GkeFluentBitAgentProps, GkeFluentBitAgentResult, GkeOtelCollectorProps, GkeOtelCollectorResult, GkeExternalDnsAgentProps, GkeExternalDnsAgentResult, AksExternalDnsAgentProps, AksExternalDnsAgentResult, ModelSource, ModelProps, ModelResult, } from "./composites/index.js";
 export * from "./actions/index.js";
 export { fetchK8sSchema, fetchSchemas, K8S_SCHEMA_VERSION } from "./spec/fetch.js";
 export { parseK8sSwagger, k8sShortName, k8sServiceName, gvkToTypeName, gvkToApiVersion } from "./spec/parse.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAKrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGlI,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,aAAa,EAAE,UAAU,EACzB,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,GAC9E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,cAAc,EAAE,aAAa,EAC7B,oBAAoB,EAAE,mBAAmB,EACzC,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,GACpD,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAKrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGlI,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGxG,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,aAAa,EAAE,UAAU,EACzB,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAC7E,KAAK,EAAE,sBAAsB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,cAAc,EAAE,aAAa,EAC7B,oBAAoB,EAAE,mBAAmB,EACzC,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,EACnD,WAAW,EAAE,UAAU,EAAE,WAAW,GACrC,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "0640b884facfca510e23b1d775b4973fa6644a3d502678e3a8f04c303148be03",
-    "meta.json": "6ec9419aa1aed8402b7957955f2a67e8c641861cfd3650886fb0898db5df14f6",
-    "types/index.d.ts": "ef2c9df6a4d1ebfbe33f96c094fbbe3fc7909522ea38e086666fbf3c8ac477fd",
+    "manifest.json": "b7ddd2a421f62e2657970def669fe33d64dcef199d43aacb6866b1cd686f9fc1",
+    "meta.json": "8b999bc142f448b0b627ecdc9e2388bbe672c8a1f7aae5303135624cf2fe65e3",
+    "types/index.d.ts": "5f67de738adb455805e72600948940af9c664283785fb68c9fd8f5ea90d42cc3",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
     "rules/argo-ast.ts": "f57b7d84fef9c9cd326a7cad0dff290914e01299415d64bdab48e2f6eb4181c3",
     "rules/argo-automated-prune.ts": "176ac5441c3ccb7106a194abab3abe22fd8a29f976716761c66c243b72d57b14",
@@ -18,7 +18,8 @@
     "rules/crd-schema-helpers.ts": "62e8d3d3557f6046ead90cce7198aa1f59838acc7b4229c5dda0cf2a2893fec9",
     "rules/flux002.ts": "4269ce13121bc5b28c02aad06765dc85085a1c9ebcc936ae958663b85de07bc6",
     "rules/flux003.ts": "a174af9941bd2491a9bbf72039ab2fc4d4f4de388b2884ddf7123f05594d9d4e",
-    "rules/k8s-helpers.ts": "d7d5020bc9b47bfb1827e8c8cb13ad1d406890d08a964a521c9fbcb93b230827",
+    "rules/k8s-helpers.ts": "68eab9ba2c28057ed20146eb69d59cb3754f09698508847d2008b53a1a3ef563",
+    "rules/sops-helpers.ts": "c2b8e08e7d292e770fd4761ad2a55e165c7cd375768b709491165cbf4fa1ba51",
     "rules/wk8005.ts": "71c3f6e68da973c466b2d5cf109bf4728b1671794aeca8e8fde79c80c8715ec1",
     "rules/wk8006.ts": "8705b24db14c9af12c6c45c5a8ecb5f4f427a5f76706ac2c82ba2949d41c498c",
     "rules/wk8041.ts": "e55f97a9e1bc407ca681366c1f9e3dd93b73bbff5f5593dfcf0991c068c28658",
@@ -45,8 +46,15 @@
     "rules/wk8401.ts": "860e5104d53158ebea790f5acc3d34b82d666c4808d8ee5de44b68c1c602af77",
     "rules/wk8402.ts": "91c58dc146c6aa44b93f167fd5ed8c16cb5dc95e9d99f40685d9d0acdf7eb474",
     "rules/wk8403.ts": "abf42e48d9539768856d71d365b5e6cbb9d4800b9f890809b70d181641a86b98",
+    "rules/wk8404.ts": "5ff2ed713bf7d7f67837946bd90caaaa7783fb9349984d82b0d65a1e6816299a",
+    "rules/wk8405.ts": "aa04d83a16c55090ea2fee2b0f37d9d2124ed38de10ae792d78547705c62ae50",
+    "rules/wk8406.ts": "0c368dcc2772044c9de7d6ebbd51f8fd9c31d3759809d6c5bee528c50310462f",
+    "rules/wk8407.ts": "b1b0e0b1de9920bf75898417b589e48a0a965febfb023fd9f0482f883b5876b6",
     "rules/wk8501.ts": "7de8c368ae0b0a2678441a97ec6bed8172f1f127bad6a8441b39ea8d1d4f1dd3",
     "rules/wk8502.ts": "c13813543b4ec42b9b87d2ebfe20bae3e6e954a8d7c4e9387581a753484aa778",
+    "rules/wk8503.ts": "4ee80ded81a0b2cff24013b300ee3fcadbfd29e20346b964a97e557afa1147f3",
+    "rules/wk8504.ts": "b1dd7689e37f788fb4524c42254d5d99048a38203643a405f25383ac21b74e36",
+    "rules/wk8505.ts": "4384b6ed92372d5995b1debdb0a7573ea342c40d16d94ffcd25b7abfbb3ea685",
     "skills/chant-k8s.md": "222268f9e6b19912ece4b066d8897f009b90a3fe6f14e9c5059d0717e7ee0f82",
     "skills/chant-k8s-patterns.md": "683148e9f0f9da6879bd65d97c82cc29dbff897e31bc11b3c1de654cd6baeea3",
     "skills/chant-k8s-deployment-strategies.md": "c4cc93cba064230567baa755b5a3493dc69bfc6e74a62e1990d12039ffaaf5f8",
@@ -57,5 +65,5 @@
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5",
     "skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
   },
-  "composite": "4021f2a6439bc3da4d7659b7318d997d0d1c8ff70a813c7240094b4bf16e9605"
+  "composite": "9fb40ca8a408c4b1811a93cc153a938ec8b482ab60be404eca94e8279eaf5777"
 }

package/dist/kube/apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/kube/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAiB,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG1G,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE7H,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoEvF"}
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/kube/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAiB,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG1G,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE7H,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyEvF"}

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAkCpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAyCpD,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAmCvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAkC3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA0CvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAyC3C,CAAC"}

package/dist/lint/post-synth/k8s-helpers.d.ts

@@ -4,7 +4,7 @@
  * Provides YAML parsing for multi-document K8s manifests and container
  * extraction logic that handles all common workload types.
  */
-export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+export { getPrimaryOutput, getAdditionalFiles } from "@intentius/chant/lint/post-synth";
 /**
  * A parsed Kubernetes manifest (loosely typed).
  */
@@ -70,6 +70,33 @@ export declare function extractContainers(manifest: K8sManifest): K8sContainer[]
  * Workload kinds that contain pod templates.
  */
 export declare const WORKLOAD_KINDS: Set<string>;
+/**
+ * Workload kinds that can request `nvidia.com/gpu` — the built-in workload
+ * kinds plus KServe's ServingRuntime/ClusterServingRuntime, which declare
+ * `containers`/`tolerations` directly on spec (see `extractPodSpec`).
+ */
+export declare const GPU_POD_KINDS: Set<string>;
+/** A Kubernetes toleration (loosely typed). */
+export interface K8sToleration {
+    key?: string;
+    operator?: "Exists" | "Equal";
+    value?: string;
+    effect?: string;
+    [key: string]: unknown;
+}
+/** Resource name used for GPU requests/limits across the lexicon. */
+export declare const NVIDIA_GPU_RESOURCE = "nvidia.com/gpu";
+/**
+ * True when any container in `containers` requests or limits
+ * `nvidia.com/gpu`.
+ */
+export declare function requestsGpu(containers: K8sContainer[]): boolean;
+/**
+ * True when `tolerations` includes one that tolerates the `nvidia.com/gpu`
+ * taint — either an explicit `key: "nvidia.com/gpu"` toleration, or a
+ * wildcard `{ operator: "Exists" }` with no key (tolerates every taint).
+ */
+export declare function toleratesGpu(tolerations: unknown): boolean;
 /**
  * Parse a Kubernetes memory string to bytes.
  *

package/dist/lint/post-synth/k8s-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"k8s-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/k8s-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrE,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IACjF,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAkB7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,WAAW,GACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA2BhC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAuBvE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,aAOzB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CASlD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAInE"}
+{"version":3,"file":"k8s-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/k8s-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrE,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IACjF,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAkB7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,WAAW,GACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAkChC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAuBvE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,aAOzB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,aAAa,aAIxB,CAAC;AAEH,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,OAAO,CAM/D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAK1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CASlD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAInE"}

package/dist/lint/post-synth/sops-helpers.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Shared helper for the committed-encrypted secret checks: join each
+ * `declareSecret({ provenance: "committed-encrypted" })` in the entity map to
+ * the sidecar file the build emitted for it.
+ *
+ * The join has to go through `output.files`, not `getPrimaryOutput`. The
+ * ciphertext is deliberately kept OUT of the primary output — that is what
+ * makes applying an undecrypted Secret structurally impossible — so a check
+ * that reads only the primary output sees nothing at all here.
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter.
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { CommittedEncryptedSecretDeclaration } from "@intentius/chant/secret-provenance";
+import { type EncryptedSecretDocument } from "../../sops/encrypted-secret-file.js";
+/** One committed-encrypted declaration, joined to what the build emitted for it. */
+export interface ResolvedEncryptedSecret {
+    /** The entity-map key the declaration was discovered under. */
+    entityName: string;
+    declaration: CommittedEncryptedSecretDeclaration;
+    /** The sidecar filename the declaration's path maps to. */
+    filename: string;
+    /** Undefined when the build emitted no such sidecar — the file did not resolve. */
+    text?: string;
+    /** Everything wrong with the emitted document. Empty when it is clean. */
+    problems: string[];
+    /** Parsed structure, when the document parsed at all. */
+    document?: EncryptedSecretDocument;
+}
+/** Every sidecar file across every lexicon output, keyed by filename. */
+export declare function allAdditionalFiles(ctx: PostSynthContext): Map<string, string>;
+/**
+ * Join every committed-encrypted declaration to its emitted sidecar,
+ * validating the document as it goes. A declaration with no sidecar comes
+ * back with `text` undefined and one problem naming the missing file.
+ */
+export declare function resolveEncryptedSecretClaims(ctx: PostSynthContext): ResolvedEncryptedSecret[];
+//# sourceMappingURL=sops-helpers.d.ts.map

package/dist/lint/post-synth/sops-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sops-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/sops-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AAE9F,OAAO,EAAoF,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAElK,oFAAoF;AACpF,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,mCAAmC,CAAC;IACjD,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ7E;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,gBAAgB,GAAG,uBAAuB,EAAE,CA2B7F"}

package/dist/lint/post-synth/wk8404.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WK8404: GPU request without a matching toleration
+ *
+ * A pod that requests `nvidia.com/gpu` but carries no toleration for the
+ * `nvidia.com/gpu` taint won't schedule onto a tainted GPU node pool (see
+ * `GpuNodePool`, #987, which taints its nodes `nvidia.com/gpu=present` by
+ * default). The pod sits `Pending` with `0/N nodes are available` until a
+ * toleration is added.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8404: PostSynthCheck;
+//# sourceMappingURL=wk8404.d.ts.map

package/dist/lint/post-synth/wk8404.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8404.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8404.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAW9G,eAAO,MAAM,MAAM,EAAE,cAiCpB,CAAC"}

package/dist/lint/post-synth/wk8405.d.ts

@@ -0,0 +1,13 @@
+/**
+ * WK8405: Serving workload without a PodDisruptionBudget
+ *
+ * An InferenceService (or a Deployment carrying a serving
+ * `app.kubernetes.io/component` label — e.g. `inference-service` or
+ * `vllm-serving-runtime`) with no PodDisruptionBudget selecting it can lose
+ * every replica at once during a voluntary disruption (node drain, cluster
+ * upgrade), taking the model endpoint down. Serving workloads should ship
+ * with a PDB.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8405: PostSynthCheck;
+//# sourceMappingURL=wk8405.d.ts.map

package/dist/lint/post-synth/wk8405.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8405.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8405.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAc9G,eAAO,MAAM,MAAM,EAAE,cAiCpB,CAAC"}

package/dist/lint/post-synth/wk8406.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WK8406: No resource limits on a GPU pod
+ *
+ * A container that requests `nvidia.com/gpu` but sets no cpu/memory limits
+ * can starve other pods on the same (expensive, scarce) GPU node of CPU and
+ * memory headroom. Unlike WK8201's general resource-limits guidance, this
+ * check is scoped to GPU-requesting containers specifically, since GPU node
+ * capacity is costlier and more contended than a general-purpose pool.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8406: PostSynthCheck;
+//# sourceMappingURL=wk8406.d.ts.map

package/dist/lint/post-synth/wk8406.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8406.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8406.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA8CpB,CAAC"}

package/dist/lint/post-synth/wk8407.d.ts

@@ -0,0 +1,21 @@
+/**
+ * WK8407: Unpinned model version
+ *
+ * KServe's InferenceService predictor pins a model by `storageUri`. The
+ * `Model` composite (#986) always appends `version` as the trailing path
+ * segment (`scheme://id/version`), so a resolved `Model` reference is
+ * always pinned — but `InferenceService.model` also accepts a raw
+ * `storageUri` string (#985), which can bypass that guarantee (e.g.
+ * `"gs://bucket/model"` with no version segment, or a floating tag like
+ * `"latest"`/`"main"`). An unpinned reference means a redeploy of the same
+ * InferenceService can silently pick up different weights.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * True when `storageUri` has an explicit, non-floating version segment:
+ * `scheme://path/version` with at least two path segments after the
+ * scheme, and the last segment isn't a known floating tag.
+ */
+export declare function isPinnedStorageUri(storageUri: string): boolean;
+export declare const wk8407: PostSynthCheck;
+//# sourceMappingURL=wk8407.d.ts.map

package/dist/lint/post-synth/wk8407.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8407.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8407.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAS9D;AAED,eAAO,MAAM,MAAM,EAAE,cAmCpB,CAAC"}

package/dist/lint/post-synth/wk8503.d.ts

@@ -0,0 +1,39 @@
+/**
+ * WK8503: Workload consumes a Secret nothing in the output produces
+ *
+ * A pod that references a Secret which no manifest in the same build creates
+ * passes `chant build`, passes `chant lint`, applies cleanly — and then fails
+ * at pod start with `CreateContainerConfigError` (chant #1382). This check
+ * closes that gap with the same cross-resource bundle-join ARGO003 uses: every
+ * secret reference in a pod spec (envFrom.secretRef, env valueFrom
+ * secretKeyRef, secret volumes, projected secret sources, imagePullSecrets)
+ * must resolve to a Secret the output produces.
+ *
+ * Producers are the Secret manifests themselves plus the secret-materializing
+ * CRs the lexicon knows: `ExternalSecret` (spec.target.name, defaulting to the
+ * CR's own name), `InfisicalSecret` / `InfisicalDynamicSecret`
+ * (spec.managedSecretReference.secretName — its secretNamespace is honored
+ * separately from the CR's metadata.namespace), and cert-manager
+ * `Certificate` (spec.secretName). Namespaces must be compatible; a side with
+ * no namespace matches any.
+ *
+ * The typed waiver is a `SecretProvenance` declaration (chant #1828, epic
+ * #1365): a `declareSecret({ name, provenance: "referenced" | "from-provider"
+ * | "generated-once" })` covering the secret's name says the estate knows
+ * where the value comes from, and silences the check. That is what lets this
+ * ship at error severity with no suppression comment — a secret minted out of
+ * band is declared, not ignored. References marked `optional: true` are
+ * skipped (the author already said it may not exist).
+ *
+ * `committed-encrypted` is deliberately NOT in that waiver set. The other
+ * three kinds are promises about something outside the build; a
+ * committed-encrypted declaration is a claim about an artifact inside it, and
+ * the build emits that artifact. So it joins the PRODUCER set instead, with
+ * its namespace read from the emitted ciphertext (SOPS leaves metadata
+ * cleartext) — which means namespace matching applies to it exactly as it
+ * does to a literal Secret, and a declaration whose file is broken fails
+ * WK8504 rather than silently waiving this check.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8503: PostSynthCheck;
+//# sourceMappingURL=wk8503.d.ts.map

package/dist/lint/post-synth/wk8503.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8503.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8503.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AA+H9G,eAAO,MAAM,MAAM,EAAE,cAwDpB,CAAC"}

package/dist/lint/post-synth/wk8504.d.ts

@@ -0,0 +1,28 @@
+/**
+ * WK8504: committed-encrypted secret declaration does not resolve
+ *
+ * `declareSecret({ provenance: "committed-encrypted", file })` is a claim
+ * about an artifact INSIDE the build, which is what separates it from the
+ * three kinds that promise something outside one. A claim inside the build
+ * should be verified rather than taken on trust, and this is the check that
+ * makes it falsifiable: it fires when the declared file produced no sidecar,
+ * when the emitted document is not a `v1` Secret of the declared name, when
+ * it carries no `sops` block, or when a `data`/`stringData` value is not
+ * `ENC[...]`-shaped.
+ *
+ * That last case is the failure this rule exists for: someone edits
+ * `db-credentials.sops.yaml` by hand, forgets `sops -e`, and commits
+ * plaintext. Before this, nothing in chant would notice.
+ *
+ * It reads `output.files`, not `getPrimaryOutput`. The ciphertext is
+ * deliberately kept out of the primary output — that is what makes applying
+ * an undecrypted Secret structurally impossible — so every other post-synth
+ * check in the lexicon is blind to it by construction, and this one has to
+ * ask for the sidecars explicitly.
+ *
+ * A value is only ever tested for the `ENC[` prefix; the message names the
+ * offending KEY, never what was found there.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8504: PostSynthCheck;
+//# sourceMappingURL=wk8504.d.ts.map

package/dist/lint/post-synth/wk8504.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8504.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8504.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAsBpB,CAAC"}

package/dist/lint/post-synth/wk8505.d.ts

@@ -0,0 +1,28 @@
+/**
+ * WK8505: committed-encrypted secret with no Flux decryption wiring
+ *
+ * Flux is the thing that actually decrypts a committed-encrypted secret's
+ * sidecar, via `spec.decryption` on the reconciling `Kustomization`
+ * (`FluxAppFor`'s `decryption` option). Nothing forces the two calls to be
+ * wired together: `declareSecret({ provenance: "committed-encrypted" })` and
+ * `FluxAppFor(...)` are independent, so it is easy to add the ciphertext
+ * without adding the wiring — the build succeeds, WK8504 passes because the
+ * file resolves cleanly, and Flux still applies the sidecar as raw
+ * `ENC[...]` bytes because nothing told it to decrypt first.
+ *
+ * Warning, not error. The reference project shape (`examples/flux-apps`)
+ * runs the workload build and the Flux build as separate `chant build`
+ * invocations, so "no Kustomization in THIS build sets spec.decryption" can
+ * mean "wired up in the other build" as easily as "forgotten" — the design
+ * doc's §4 explains why no path-to-build-target join exists to tell those
+ * apart. Promote to error if that join ever becomes available.
+ *
+ * Fires only on claims that actually resolved (`problems.length === 0`, via
+ * `resolveEncryptedSecretClaims`), not on every raw declaration. An
+ * unresolved declaration is already WK8504's job at error severity; firing
+ * this warning on top of it would report a Flux wiring gap for a Secret the
+ * build has not confirmed exists.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8505: PostSynthCheck;
+//# sourceMappingURL=wk8505.d.ts.map

package/dist/lint/post-synth/wk8505.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8505.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8505.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAa9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.46.0",
+  "version": "0.49.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],